{"id":10787,"url":"https://alion.io/job/coalfire-detection-and-response-engineer","title":"Detection and Response Engineer (SPLUNK)","company":{"id":3522,"name":"Coalfire","domain":"coalfire.com","url":"https://alion.io/company/coalfire","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":80000,"max":134000,"currency":"USD","period":"year","gross":null,"usd_annual":134000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"LogRhythm","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST 800-53","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Sumo Logic","optional":false},{"name":"Ansible","optional":true},{"name":"FedRAMP","optional":true},{"name":"GitHub","optional":true},{"name":"GitLab","optional":true},{"name":"HIPAA","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-07-21T18:27:25Z","employer_posted_date":"2026-07-21","last_verified_at":"2026-10-17T23:44:45Z","board_verified":true,"closed_at":null,"days_open":88,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":88},"description":"Why Join Us\nWe are seeking a Detection and Response Engineer to join our Defensive Services team, supporting SIEM monitoring and alerting, threat hunting, and purple team activities that help our clients meet both federal compliance and commercial security requirements. If you're passionate about defending organizations against evolving threats, driven to innovate, and thrive in a collaborative, high-performing environment, we'd love to have you on our team. Join us in our mission to make the world a safer place through proactive cybersecurity and operational excellence.\nWhat You'll Do\nCollect, analyze, and operationalize threat intelligence to inform proactive detection and threat-hunting activities, driving measurable security posture improvements across client environments.\nDevelop, optimize, and maintain custom detection and threat-hunting queries across two or more SIEM platforms, tuning alerts for improved fidelity and building dashboards and saved searches that support repeatable, operational use cases.\nPlan and lead cyclical, hypothesis-driven threat hunts using threat intelligence and behavior-based analytics; identify detection gaps and telemetry blind spots, and translate hunt outcomes into detection improvements, alert tuning, and updated runbooks. \nWhat You'll Bring\n2-4 years of experience operating within large-scale enterprise security environments, including exposure to cloud-hosted or hybrid infrastructures.\nFoundational working knowledge of at least one major cloud platform (Azure, AWS, or GCP) and how cloud telemetry is leveraged for security monitoring and investigations.\nHands-on experience with at least two SIEM platforms (e.g., Splunk, Microsoft Sentinel, ELK, LogRhythm, or Sumo Logic) in a production detection and response environment.\nExperience independently monitoring, validating, and escalating SIEM alerts in accordance with documented runbooks, SLAs, and severity thresholds.\nProven ability to independently investigate and respond to security alerts, performing deep-dive analysis across multiple log sources to determine scope, root cause, and impact.\nExperience escalating confirmed or high-confidence incidents with clear timelines, evidence, and MITRE ATT&CK mapping to Incident Response teams or senior engineers.\nExperience conducting structured and cyclical threat-hunting activities using hypothesis-driven and behavior-based methodologies.\nAbility to leverage threat intelligence to understand threat actor tradecraft, attack chains, and expected telemetry, and apply that knowledge to investigations and hunts.\nHands-on experience developing, optimizing, and maintaining custom detection and threat-hunting queries in at least two SIEM platforms, and translating investigative requirements into performant, reusable query logic.\nExperience identifying detection gaps, telemetry blind spots, and data quality issues, and translating findings into alert tuning, new detection logic, dashboards, and updated runbooks or SOPs.\nExcellent communication, organizational, and problem-solving skills, with the ability to convey complex technical information clearly.\nStrong documentation skills for creating technical diagrams, written descriptions, and other supporting materials.\nDemonstrated ability to work both independently and as a member of a team, maintaining a professional attitude and demeanor.\nCritical thinking skills to balance robust security requirements against mission objectives.\nProven track record of adapting quickly and efficiently in fast-paced, dynamic environments.\nExperience utilizing a Detection-as-Code framework\nExperience working with NIST 800-53 environments \nREQUIRED CERTIFICATIONS:\nAt least one of the following:\nSplunk Enterprise Certified Administrator \nSplunk Enterprise Security Certified Administrator \nSumoLogic Administrator \nMicrosoft Security Operations Associate \nElastic Stack Certified Administrator \nBonus Points\nProfessional services background: Prior experience supporting external clients from within a consulting or professional services organization. \nAutomation capabilities: Experience automating workflows in GitLab or GitHub with Terraform and Ansible. \nCompliance frameworks: Understanding of FedRAMP, FISMA, HIPAA, HITRUST, PCI, and similar regulatory standards.","description_format":"text","description_chars":4286,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-07-21T18:27:25Z"}],"visa":[],"liveness":{"score":5,"band":"cold","label":"Long shot","p_open":1,"p_active":0.192,"p_room":0.28,"age_days":87,"expected_fill_days":15,"reasons":["conf:1","win:tail","crowd:junior"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":134000,"is_top_pay":true},"html_url":"https://alion.io/job/coalfire-detection-and-response-engineer","json_url":"https://alion.io/job/coalfire-detection-and-response-engineer.json","meta":{"generated_at":"2026-10-18T01:04:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1768,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3522},"rest":"https://alion.io/mcp/rest/get_company?id=3522"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcoalfire-detection-and-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcoalfire-detection-and-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcoalfire-detection-and-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/coalfire-detection-and-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcoalfire-detection-and-response-engineer"}]}